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This is in response to the appeal brief filed 8/13/2007 appealing from the Office action mailed 
4/13/2007. 
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(1) Real Party in Interest 

A statement identifying by name the real party in interest is contained in the brief. 

(2) Related Appeals and Interferences 

The examiner is not aware of any related appeals, interferences, or judicial proceedings 
which will directly affect or be directly affected by or have a bearing on the Board's decision in 
the pending appeal. 

(3) Status of Claims 

The statement of the status of claims contained in the brief is correct. 

(4) Status of Amendments After Final 

The appellant's statement of the status of amendments after final rejection contained in 
the brief is correct. 

(5) Summary of Claimed Subject Matter 

The summary of claimed subject matter contained in the brief is correct. 

(6) Grounds of Rejection to be Reviewed on Appeal 

The appellant's statement of the grounds of rejection to be reviewed on appeal is correct. 

(7) Claims Appendix 

The copy of the appealed claims contained in the Appendix to the brief is correct. 

(8) Evidence Relied Upon 

6, 1 82,022 MAYLE et al 1 -200 1 

6,098,195 NORTHCOTT 8-2000 

6,397,359 CHANDRA et al 5-2002 
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(9) Grounds of Rejection 

The following ground(s) of rejection are applicable to the appealed claims: 



Claims 1-14, 16 and 17 are pending . 



Claim Rejections - 35 USC § 102 
I. The following is a quotation of the appropriate paragraphs of 35 U.S. C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 



II. Claims 1, 13, 16 and 17 are rejected under 35 U.S.C. 102(e) as being anticipated by 
Mayleetal(US 6,182,022). 

a. Per claims 1 and 16 (differs only by statutory class), Mayle et al teach a method 
of monitoring an element in a computer network, said method comprising: 

• monitoring a preselected variable relating to said element (abstract, col. 3 lines 
34-38 and 48-67 — monitoring attributes of a system); 

• defining a threshold for the monitored preselected variable (col. 4 lines 1-7, col. 6 
line 40-col.8 line 31 — defined thresholds for monitored attributes); 

• establishing a sliding window in time (col. 4 lines 29-36— provision for sliding 
window of time); 

• repeatedly generating a time above threshold value, said time above threshold 
value being a measure of an amount of time during which the monitored variable 
exceeded the threshold during the sliding window of time, wherein the measure of 
the amount of time during which the monitored variable exceeded the threshold 
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during the sliding window in time includes an aggregation of two or more 
noncontiguous time intervals during which the monitored variable exceeded the 
threshold during the sliding window in time (col. 4 line 36-col.5 line 26, col. 7 
lines 13-24, col. 8 lines 56-65 — generating a time above threshold value during 
the sliding window which includes a frequency and duration of a pre-determined 
number of times over a threshold over a predetermined period of time); 

• detecting when the time above threshold value exceeds a predefined condition 
window value (col. 4 line 64-col.5 line 9 — detection when time above threshold 
exceed a specific time interval); and 

• in response to detecting when the time above threshold value exceeds said 
condition window, generating an alarm (col. 4 lines 8-14, col. 5 lines 9-12 — alarm 
is generated when the threshold has been exceeded). 

b. Per claims 13 and 17 (differs only by statutory class), Mayle et al teach a method 
of monitoring an element in a computer network, said method comprising: 

• defining a profile for that element, said profile including a plurality of different 
alarm rules, each of said different alarm rules establishing an alarm test for a 
corresponding one or more variables (col. 5 lines 5-38 — monitored attributes with 
defined thresholds); 

• detecting when the alarm test for any one or more of the plurality of different 
alarm rules is met (col. 5 lines 26-35 — alarm generated when a defined threshold 
rule has been exceeded); 

• repeatedly generating a time above threshold value, said time above threshold 
value being a measure of an amount of time during which at least one of the one 
or more alarm tests has been met during a preselected prior window of time, 
wherein the measure of the amount of time during which at least one of the one or 
more alarm tests has been met during the preselected prior window in time 
includes an aggregation of two or more noncontiguous time intervals during 
which at least one of the one or more alarm tests has been met during a 
preselected prior window in time (col. 4 line 36-col.5 line 26, col. 8 lines 45-65 — 
generating a time above threshold value during the sliding window which 
includes a frequency and duration of a pre-determined number of times over a 
threshold over a predetermined period of time); 
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• detecting when the time above threshold value exceeds a predefined condition 
window value {col. 4 line 64-col.5 line 9, col. 6 line 40-col.8 line 31 — detection 
when time above threshold exceed a specific time interval); and 

• in response to detecting when the time above threshold value exceeds said 
condition window, generating an alarm (col. 4 lines 8-14, col. 5 lines 9-12, col.9 
lines 40-50 — alarm generated when the threshold has been exceeded). 



Claim Rejections - 35 USC § 103 

III. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

IV. Claims 2-4 and 14 are rejected under 35 U.S.C. 103(a) as being unpatentable over Mayle 
et al (US 6,182,022) in view of Northcott (USPN 6,098,195). 

a. Per claim 2, Mayle et al teach the method of claim 1 as applied above, yet fail to 

explicitly teach the method of claim 1 further comprising after generating an alarm, maintaining 
the alarm at least as long as the time above threshold value exceeds a clear window value. 
However, Northcott teaches generating an alarm condition when the counters exceed the 
threshold limit and maintaining the alarm as long as the counters are above the threshold level 
{col. 3 lines 21-30). It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to combine the teachings of Mayle et al with Northcott for the purpose of 
asserting an alarm upon the detection of a specific event or condition and continuing in the alarm 
state; because it would provide an indication declaring the status of the system's operating 
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functions — whether the exception/fault initiating the alarm has been remedied or whether the 
condition is still occurring. 

b. Claim 14 is substantially equivalent to claim 2, and is therefore rejected under the 
same basis. 

c. Per claim 3, Mayle et al with Northcott teach the method of claim 2, Northcott 
further teaches the method of claim 2 wherein said clear window value is equal to said condition 
window value {col. 3 lines 13-25; the time above threshold exceeds a clear window value, T time 
periods, which is also the condition window value that when exceeded, generates the alarm). 

d. Per claim 4, Mayle et al with Northcott teach the method of claim 3, Mayle et al 
further teach the method further comprising: 

• monitoring a plurality of variables relating to said element, said preselected 
variable being one of said plurality of variables (col. 5 lines 5-38, col. 7 lines 3- 
10 — monitored attributes with defined thresholds); and 

• for each of the plurality of monitored variables, defining a corresponding 
threshold for that other variable, wherein the time above threshold value is a 
measure of an amount of time during which any one or more of the monitored 
variables exceeded its corresponding threshold during the corresponding sliding 
window of time (col. 8 lines 53-65, col. 9 lines 30-50 — generated alarms when 
defined attribute threshold rule has been exceeded). 

V. Claims 5-12 are rejected under 35 U.S.C. 103(a) as being unpatentable over Mayle et al 
(US 6,182,022) in view of Chandra et al (USPN 6,397,359). 

a. Per claim 5, Mayle et al teach the method of claim 1 as applied above. Mayle et al 
teach computing a minimum nuisance level threshold, wherein the current normal threshold is 
increased by the minimum nuisance level for generating the alarm at a reasonable level (col. 7 
line 62-col.8 line 23). However, Chandra et al further teach the method of claim 1 wherein the 
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step of defining the threshold for the preselected variable comprises: defining an excursion 
amount; and setting the threshold equal to a sum of the average value plus the excursion amount 
by implementing an auto-threshold computation, with an excursion amount equal to the product 
of the Stdev count and Critical stdev (or Stdev); wherein the auto-threshold value is equal to the 
sum of the mean plus the excursion amount {col. 24 lines 58-67). It would have been obvious to 
one of ordinary skill in the art at the time the invention was made to combine the teachings of 
Mayle et al with Chandra et al for the purpose of enhancing threshold criteria to rely on an 
additional values instead of just one amount; because it would aid in establishing a more intricate 
monitoring system thereby reducing false alarms. It would also allow for the use of more precise 
condition indicators capable of differentiating and expanding alarm states that are based on 
additional values. 

b. Per claim 6, Mayle al with Chandra et al teach the method of claim 5, wherein the 
corresponding period of time is less than a day {Chandra et al: col. 3 lines 24-32, col. 8 lines 14- 
26, col. 13 lines 19-25 and col. 14 lines 3-29; the time period for active or passive performance 
testing may be periodic or variable based on the schedule and the user 's preference; Mayle et al: 
col.4 lines 26-36, col. 5 lines 39-58). 

c. Claim 7 is substantially similar to claim 6 and is therefore rejected under the same 

basis. 

d. Per claim 8, Mayle al with Chandra et al teach the method of claim 6 wherein the 
step of computing the average comprises computing a mean value for the preselected variable 
using values obtained for that preselected variable for the same hour period of the same day of 
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the week for a predetermined number of previous weeks {Chandra et al: col. 24 lines 29-57; 
Mayle et al: col. 5 lines 39-58, col.8 lines 45-48 and 56-65). 

e. Per claim 9, Mayle al with Chandra et al teach the method of claim 5 wherein the 
step of defining an excursion amount comprises: computing a standard deviation for the 
preselected variable based on values obtained for the preselected variable over a predetermined 
period of time; and setting the excursion amount equal to K times the computed standard 
deviation, wherein K is a positive number {Chandra et al: col. 24 line 61 -col. 2 5 line 8; the 
standard deviation of the performance results in calculated and can be multiplied by 
Stdev_count, K, which is a user configurable value comprising positive numbers; Mayle et al: 
col. 5 line 67-col.6 line 32, col.8 lines 1-7). 

f. Per claim 10, Mayle al with Chandra et al teach the method of claim 9 wherein 
the step of computing the standard deviation comprises computing the standard deviation using 
values obtained for that preselected variable for the same hour period of the same day of the 
week for a predetermined number of previous weeks {Chandra et al: col. 2 4 lines 34-57; in the 
auto-threshold computation, the standard deviation can be calculated using the values for the 
variables on a periodic basis; Mayle et al: col. 5 line 67 -col. 6 line 32, col.8 lines 1-7). 

g. Per claim 11, Mayle al et al teach the method of claim 1 as applied above, yet fail 
to distinctly teach the method of claim 1 wherein the step of defining the threshold for the 
preselected variable comprises: defining an excursion amount; and setting the threshold equal to 
H less the excursion amount, where H is a positive number. However, Chandra et al teach auto- 
threshold computations which comprise calculating a standard deviation of the results and it is 
well-known that the standard deviation is calculated with a plus-or-minus, +/-, factor; thus in the 
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minus condition, the threshold would be equal to a value, H, less the excursion amount {col. 24 
line 58-col.25 line 19). Furthermore, Mayle et al teach computing a minimum nuisance level 
threshold, wherein the current normal threshold is increased by the minimum nuisance level for 
generating the alarm at a reasonable level (col. 7 line 62-col.8 line 23). It would have been 
obvious to one of ordinary skill in the art at the time the invention was made to combine the 
teachings of Mayle et al with Chandra et al for the purpose of enhancing threshold criteria to 
rely on an additional value instead of just one amount; because it would aid in establishing a 
more intricate monitoring system thereby render more exact measurements by offsetting and 
weighing the performance results. It would also allow for the use of more precise threshold 
indicators capable of differentiating alarm states and determining performance trends and 
characteristics bases on the additional values. 

h. Claim 12 is substantially similar to claim 9 and is therefore rejected under the 
same basis. 

(10) Response to Argument 

Appellant argues — with respect to claims 1, 13, 16 and 17 — that the Mayle et 
al reference fails to disclose the claimed feature of "an amount of time during 
which the monitored variable exceeded the threshold during the sliding 
window in time [that] includes an aggregation of two or more noncontiguous 
time intervals during which the monitored variable exceeded the threshold 
during the sliding window in time". 

Examiner respectfully disagrees. Mayle et al teach the implementation of two 
rules for generating alarms upon receipt of even notifications: the duration rule, which requires 
the collected metrics to be beyond the current normal threshold for a pre-determined amount of 
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time; and the frequency rule, which requires a pre-determined number of metrics to be beyond 
the current normal threshold during a pre-determined amount of time (column 2 lines 17-24, 
column 4 lines 22-25). In reference to the frequency rule, Appellant argues that "[MJerely 
counting a number of times that the monitored metric breaches the threshold does not take into 
account the total amount of time spent above the threshold during noncontiguous periods". 
However, Mayle et a/'s teaching of the frequency rule is made clear by the example illustrated in 
Figure 3, wherein the frequency count is made in reference to a collection of contiguous "metric 
samples" over a specific time period during which the amount of metric samples exceeded the 
normal threshold level N times (column 5 lines 5-26). In the example illustrated Figure 3, it can 
be seen that during time period T3, although a series of metric samples were taken at reference 
points 322, 324, 326, 328, 330, 332, 334, 336, 338, 340 and 342 the metric samples that actually 
exceeded the normal threshold level were 322, 324, 328, 330, 336, 338 and 342 — which occur at 
contiguous and noncontiguous time intervals within time period T3 (column 5 lines 12-25). 
Therefore, Mayle et a/'s teaching of a duration rule that monitors the amount of time the 
collected metrics spend over the threshold and a frequency rule that monitors the monitors the 
number of times the metric exceeds the threshold are sufficient in teaching Appellant's claimed 
limitation. 

Furthermore, Appellant's argument of "noncontiguous time intervals" is 
inconsistent with Appellant's disclosure which recites that monitoring time above a threshold can 
also be determined by "continuous time spent over the threshold" (page 15 lines 25-27, page 21 
line 20). Thus Appellant's assertion that the sliding window includes an aggregation of two or 
more noncontiguous time intervals is not a closed-ended limitation because Appellant's 
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disclosure does not solely support noncontiguous time intervals, but also makes allowance for 
contiguous/continuous time intervals. Therefore the teachings of the cited prior art which pertain 
to contiguous and noncontiguous time intervals, as discussed above, cannot be precluded. 

For the above reasons, it is believed that the rejections should be sustained. 

(11) Related Proceeding(s) Appendix 

No decision rendered by a court or the Board is identified by the examiner in the Related 
Appeals and Interferences section of this examiner's answer. 

Respectfully submitted, 
/K.D.S./ 

Examiner, Art Unit 2141 

/William C. Vaughn, Jr./ 
Supervisory Patent Examiner, Art Unit 2144 
Conferees: 

/William C. Vaughn, Jr./ 

Supervisory Patent Examiner, Art Unit 2144 

/John Follansbee/ 

Supervisory Patent Examiner, Art Unit 2151 



